CVE-2022-50850

What it actually does

The flaw is an error-handling omission in ipr_init(): when pci_register_driver() fails, unregister_reboot_notifier() is never called, leaving a reboot notifier registered and triggering a WARNING on subsequent registration attempts via notifier_chain_register.

Why it matters to the business

Unexpected kernel warnings appear during driver initialization failures, which may complicate troubleshooting, trigger monitoring alerts, or indicate broader module-loading problems on systems using the ipr driver.

How an attack unfolds

An attacker with the ability to force repeated loading of the ipr kernel module under failure conditions can cause the notifier registration warning to be emitted; no privilege escalation or code execution is possible.

How to fix it

Upgrade the Linux kernel to a version containing commit 020b66023712b1cc42c6ab8b76e4ec13efe4a092 (or later stable backports) so that unregister_reboot_notifier is always invoked on the error path; for packaged distributions apply the corresponding fixed kernel packages.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or later equivalent; attempt to load the ipr module under simulated pci_register_driver failure and verify no WARNING is emitted.

Typical attack path

1. cause pci_register_driver to fail during ipr module initialization
2. observe duplicate notifier registration attempt
3. trigger kernel WARNING

How to detect it

Search kernel logs and dmesg output for the strings “notifier callback ipr_halt [ipr] already registered” and “WARNING.*notifier_chain_register”; correlate with modprobe or ipr module load events.

• notifier callback ipr_halt [ipr] already registered
• WARNING: CPU:.*notifier_chain_register+0x16d/0x230
• ipr_init+0x30/0x1000 [ipr]

What your security team should do

• Apply the fixed kernel versions immediately on all affected systems
• Review kernel logs for the specific notifier warning string as a sign of exposure
• Prioritize updates on systems that use the ipr driver or that frequently load/unload storage modules